So while you're right that the strstr() is lazy (should probably be a strncmp() or something), it's probably not that big of a deal in this particular case. The worst an attacker could do here is get a weird user agent string, which they could already do by just setting the User-Agent field to something weird...